Manage and Tune Incidents NSE6-FORTISIEM-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company has a known internal application that generates a specific event pattern every hour, which is incorrectly flagged as a security incident. The administrator wants to prevent these incidents from being created, but still wants to see the events in the event database for troubleshooting. What should the administrator do?

   • ADisable the correlation rule that generates the incident.
   • BChange the incident priority to 'Low' so it is less visible.
   • CDelete the events from the event database as they are received.
   • DCreate a whitelist that suppresses incidents when the event pattern matches the known application.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of tuning correlation rules in FortiSIEM?

   • ATo reduce noise by adjusting how events are correlated into incidents
   • BTo increase the number of events collected from devices
   • CTo delete old incidents from the database
   • DTo change the time zone of the FortiSIEM server
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security operations team has a workflow where incidents must go through multiple stages: 'Open', 'Investigating', 'Pending', 'Resolved', and 'Closed'. The team wants to ensure that incidents cannot be closed without being resolved first. What should the administrator configure?

   • AConfigure workflow actions that enforce the status transition rules.
   • BTrain analysts to follow the workflow manually.
   • CCreate a tuning rule that suppresses incidents that are not resolved.
   • DSet the incident priority to 'Critical' so that analysts are more careful.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A FortiSIEM administrator is receiving multiple incidents for the same malware signature from many different hosts in the same subnet within a short time. The administrator wants to consolidate these into a single incident to reduce alert fatigue, while still being able to see all affected hosts. What should the administrator do?

   • ADisable the correlation rule that detects the malware.
   • BManually merge the incidents in the console each time they appear.
   • CCreate a tuning rule to suppress incidents from that subnet.
   • DEnable incident grouping based on the malware signature and time window.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the purpose of configuring workflow actions in FortiSIEM?

   • ATo increase the number of incidents generated
   • BTo delete incidents automatically
   • CTo change the time zone of the server
   • DTo track the resolution process of incidents
   Reveal Solution Discussion Select an answer first